WD NAS - language_configuration RCE (CVE-2018-18472)

Exploits backtick injection in PUT /api/1.0/rest/languageconfiguration on WD My Cloud / My Book Live. Output is written under /var/www and fetched via HTTP. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital NAS languageconfiguration RCE CVE-2018-18472 — opens execute session.""" import...

WD NAS - language_configuration RCE Detection (CVE-2018-18472)

Detects CVE-2018-18472 by injecting id via PUT /api/1.0/rest/languageconfiguration backticks and fetching the written output file. !/usr/bin/env python3 -- coding: utf-8 -- """Western Digital My Cloud / My Book Live languageconfiguration RCE CVE-2018-18472.""" import re from kittysploit import fr...

CVE-2018-18472

Western Digital WD My Book Live and WD My Book Live Duo all versions have a root Remote Command Execution bug via shell metacharacters in the /api/1.0/rest/languageconfiguration language parameter. It can be triggered by anyone who knows the IP address of the affected device, as exploited in the...

EUVD-2018-10200

Malware in sbrugna...

EUVD-2021-22576

Malware in sbrugna...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

Western Digital WD My Book Live Duo Command Execution

The vulnerability of the microprogrammed software for Western Digital WD My Book Live and WD My Book Live Duo exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute...

Western Digital WD My

The vulnerability of the microprogrammed software in Western Digital WD My Book Live and WD My Book Live Duo storage devices is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Episode 124: PrintNightmare 0Day Exploit Accidentally Leaked Online

Security researchers accidentally leaked zero-day exploit code for a new Windows bug, now called PrintNightmare, while easily exploitable vulnerabilities in the ProfilePress plugin, previously called WP User Avatar, were patched quickly. An unprotected cloud database containing over 814 million...

Western Digital My Book Live End of Life (EOL) Detection

The remote Western Digital My Book Live device has reached the End of Life EOL / End of Updates EOU and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Western Digital WD My Book Live Operating System Command Injection Vulnerability

Western Digital WD My Book Live is a network storage device from Western Digital. An operating system command injection vulnerability exists in all versions of Western Digital WD My Book Live. A remote attacker could exploit this vulnerability to execute commands...

Unspecified Vulnerability in Western Digital WD My Book Live

Western Digital WD My Book Live is a network storage device from Western Digital. A security vulnerability exists in Western Digital WD My Book Live 2.x and earlier versions and WD My Book Live Duo, which stems from the fact that the products have an administrator API that can be exploited by an...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

Authentication flaw

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

CVE-2021-35941

Western Digital WD My Book Live 2.x and later and WD My Book Live Duo all versions have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472...

CVE-2021-35941

CVE-2021-35941 affects Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions). The issue is an unauthenticated administrator API that can perform a system factory restore, as described in public records and exploited in the wild in June 2021. CVSS metrics (3.1) ind...

Western Digital WD My Book Live access control vulnerability

Western Digital WD My Book Live is a network storage device from Western Digital. A security vulnerability exists in Western Digital WD My Book Live 2.x and earlier versions and WD My Book Live Duo, which stems from the fact that the products have an administrator API that can be exploited by an...

PT-2021-3503

Name of the Vulnerable Software and Affected Versions Western Digital WD My Book Live versions 2.x and later Western Digital WD My Book Live Duo all versions Description The issue is related to deficiencies in the authentication procedure of Western Digital's WD My Book Live and WD My Book Live D...